Overview
overview
8Static
static
31aa6ab5705...18.exe
windows7-x64
71aa6ab5705...18.exe
windows10-2004-x64
7$PLUGINSDI...NS.dll
windows7-x64
3$PLUGINSDI...NS.dll
windows10-2004-x64
3$PLUGINSDI...NU.dll
windows7-x64
3$PLUGINSDI...NU.dll
windows10-2004-x64
3$PLUGINSDI...EM.dll
windows7-x64
3$PLUGINSDI...EM.dll
windows10-2004-x64
3$TEMP/Fox-...ER.exe
windows7-x64
8$TEMP/Fox-...ER.exe
windows10-2004-x64
8SWF2MP3.chm
windows7-x64
1SWF2MP3.chm
windows10-2004-x64
1SWF2MP3.exe
windows7-x64
1SWF2MP3.exe
windows10-2004-x64
1SWF2MP3.url
windows7-x64
6SWF2MP3.url
windows10-2004-x64
3ºº»¯Ï...¡.url
windows7-x64
5ºº»¯Ï...¡.url
windows10-2004-x64
1ºüÀêÉ...í.url
windows7-x64
6ºüÀêÉ...í.url
windows10-2004-x64
3жÔØÈí¼þ.exe
windows7-x64
7жÔØÈí¼þ.exe
windows10-2004-x64
7Analysis
-
max time kernel
121s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
01-07-2024 08:45
Static task
static1
Behavioral task
behavioral1
Sample
1aa6ab57058b1fa13bf2ce33358d43f3_JaffaCakes118.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
1aa6ab57058b1fa13bf2ce33358d43f3_JaffaCakes118.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/INSTALLOPTIONS.dll
Resource
win7-20240611-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/INSTALLOPTIONS.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/STARTMENU.dll
Resource
win7-20240611-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/STARTMENU.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/SYSTEM.dll
Resource
win7-20240419-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/SYSTEM.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral9
Sample
$TEMP/Fox-Temp/IEHELPER.exe
Resource
win7-20240508-en
Behavioral task
behavioral10
Sample
$TEMP/Fox-Temp/IEHELPER.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral11
Sample
SWF2MP3.chm
Resource
win7-20240611-en
Behavioral task
behavioral12
Sample
SWF2MP3.chm
Resource
win10v2004-20240611-en
Behavioral task
behavioral13
Sample
SWF2MP3.exe
Resource
win7-20240220-en
Behavioral task
behavioral14
Sample
SWF2MP3.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral15
Sample
SWF2MP3.url
Resource
win7-20240611-en
Behavioral task
behavioral16
Sample
SWF2MP3.url
Resource
win10v2004-20240611-en
Behavioral task
behavioral17
Sample
ºº»¯Ïà¹ØÎÊÌâ·´À¡.url
Resource
win7-20240611-en
Behavioral task
behavioral18
Sample
ºº»¯Ïà¹ØÎÊÌâ·´À¡.url
Resource
win10v2004-20240611-en
Behavioral task
behavioral19
Sample
ºüÀêÉÙÒ¯ºº»¯×÷Æ·Áбí.url
Resource
win7-20240508-en
Behavioral task
behavioral20
Sample
ºüÀêÉÙÒ¯ºº»¯×÷Æ·Áбí.url
Resource
win10v2004-20240508-en
Behavioral task
behavioral21
Sample
жÔØÈí¼þ.exe
Resource
win7-20240419-en
Behavioral task
behavioral22
Sample
жÔØÈí¼þ.exe
Resource
win10v2004-20240508-en
General
-
Target
ºº»¯Ïà¹ØÎÊÌâ·´À¡.url
-
Size
337B
-
MD5
f7b5d279fdaca0d76a3cd13b4cdda081
-
SHA1
1be2ce4f4a02800c6320043c59404d24b997f51a
-
SHA256
0bbf6ec991832b6ca1b14f2a8f0c020aa3aa5fa671c05b1aba01e54967ba3970
-
SHA512
a01518fb50f58648df1b9657fa171dc06391cac3766f46bde327b81e185f300b8790a567afd74d401a64730fa710dab2a80c42fd351eed7991ed145d9cf4beb4
Malware Config
Signatures
-
Drops file in System32 directory 14 IoCs
Processes:
OUTLOOK.EXEdescription ioc process File created C:\Windows\system32\perfh009.dat OUTLOOK.EXE File created C:\Windows\system32\perfc00A.dat OUTLOOK.EXE File created C:\Windows\system32\perfc00C.dat OUTLOOK.EXE File created C:\Windows\system32\perfh011.dat OUTLOOK.EXE File opened for modification C:\Windows\SysWOW64\PerfStringBackup.INI OUTLOOK.EXE File created C:\Windows\system32\perfc009.dat OUTLOOK.EXE File created C:\Windows\system32\perfc011.dat OUTLOOK.EXE File created C:\Windows\system32\perfh007.dat OUTLOOK.EXE File created C:\Windows\system32\perfc007.dat OUTLOOK.EXE File created C:\Windows\system32\perfh00C.dat OUTLOOK.EXE File created C:\Windows\SysWOW64\PerfStringBackup.TMP OUTLOOK.EXE File created C:\Windows\system32\perfc010.dat OUTLOOK.EXE File created C:\Windows\system32\perfh010.dat OUTLOOK.EXE File created C:\Windows\system32\perfh00A.dat OUTLOOK.EXE -
Drops file in Windows directory 3 IoCs
Processes:
OUTLOOK.EXEdescription ioc process File created C:\Windows\inf\Outlook\outlperf.h OUTLOOK.EXE File opened for modification C:\Windows\inf\Outlook\outlperf.h OUTLOOK.EXE File created C:\Windows\inf\Outlook\0009\outlperf.ini OUTLOOK.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Processes:
OUTLOOK.EXEdescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" OUTLOOK.EXE Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Toolbar OUTLOOK.EXE Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote OUTLOOK.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" OUTLOOK.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" OUTLOOK.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" OUTLOOK.EXE Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\MenuExt OUTLOOK.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" OUTLOOK.EXE Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel OUTLOOK.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
OUTLOOK.EXEpid process 2808 OUTLOOK.EXE -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
OUTLOOK.EXEpid process 2808 OUTLOOK.EXE -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
rundll32.exedescription pid process target process PID 1792 wrote to memory of 2808 1792 rundll32.exe OUTLOOK.EXE PID 1792 wrote to memory of 2808 1792 rundll32.exe OUTLOOK.EXE PID 1792 wrote to memory of 2808 1792 rundll32.exe OUTLOOK.EXE PID 1792 wrote to memory of 2808 1792 rundll32.exe OUTLOOK.EXE PID 1792 wrote to memory of 2808 1792 rundll32.exe OUTLOOK.EXE PID 1792 wrote to memory of 2808 1792 rundll32.exe OUTLOOK.EXE PID 1792 wrote to memory of 2808 1792 rundll32.exe OUTLOOK.EXE PID 1792 wrote to memory of 2808 1792 rundll32.exe OUTLOOK.EXE PID 1792 wrote to memory of 2808 1792 rundll32.exe OUTLOOK.EXE
Processes
-
C:\Windows\System32\rundll32.exe"C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL C:\Users\Admin\AppData\Local\Temp\ºº»¯Ïà¹ØÎÊÌâ·´À¡.url1⤵
- Suspicious use of WriteProcessMemory
-
C:\PROGRA~2\MICROS~1\Office14\OUTLOOK.EXE"C:\PROGRA~2\MICROS~1\Office14\OUTLOOK.EXE" -c IPM.Note /m "mailto:[email protected]?subject=汉化相关问题反馈~关于[软件名]"2⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\FORMS\FRMCACHE.DATFilesize
240KB
MD5b2d70bda63d67e342be4057ef99b0eff
SHA1a0dc7da7e2d26bd498223b8789b4325d37656a10
SHA25633df55747e7675591b469a83b0778a8d8312f094094d9cce92c6cecfe86db6b7
SHA512bc9537a2ba1ed24a691a6a95878e40edfdeb2a2a9c3df7f8b21efca3b6ba7d0ddf723c07383d813a37d2aad353cb20f7a507be33d367b8179deb662de79c501e
-
C:\Users\Admin\AppData\Local\Microsoft\Outlook\mapisvc.infFilesize
1KB
MD548dd6cae43ce26b992c35799fcd76898
SHA18e600544df0250da7d634599ce6ee50da11c0355
SHA2567bfe1f3691e2b4fb4d61fbf5e9f7782fbe49da1342dbd32201c2cc8e540dbd1a
SHA512c1b9322c900f5be0ad166ddcfec9146918fb2589a17607d61490fd816602123f3af310a3e6d98a37d16000d4acbbcd599236f03c3c7f9376aeba7a489b329f31
-
memory/2808-0-0x000000005FFF0000-0x0000000060000000-memory.dmpFilesize
64KB
-
memory/2808-1-0x000000007384D000-0x0000000073858000-memory.dmpFilesize
44KB
-
memory/2808-124-0x000000007384D000-0x0000000073858000-memory.dmpFilesize
44KB